Payout fraud in online gaming: hold before release.

The patterns

These are the payout-fraud types the industry and its regulators already name:

• Stolen cards and stolen identities. Accounts opened in someone else’s name and funded with stolen payment cards, then cashed out.
• Bonus abuse. Many accounts controlled by one person or ring, each claiming the welcome offer. Pennsylvania’s regulator names it, with account sharing, as a problem its know-your-customer rules are meant to prevent.
• Account takeover. A real player’s account entered with stolen credentials and emptied through a withdrawal.
• Organised cash-out rings. Groups of accounts acting together to move value out.
• Chargebacks after withdrawal. Deposits disputed as unauthorised after the money has already left.

Why the withdrawal is the place to stop it

Registration and checkout checks look at one account at one moment, and each account in a ring can pass them. The pattern shows when accounts are read together, and the money is only at risk when it leaves. So the control belongs at the withdrawal:

1. Read accounts in contextRead the withdrawing account alongside the rest of the player base, not on its own. Ask what it would look like if it were exactly what it appears to be, and check that against the record.
2. Hold the release for reviewWithdrawals the operator’s own rules mark for review wait before release. Most pass.
3. Decide, and sign itGO, HOLD or ESCALATE, by a named reviewer, under written rules the operator owns. A HOLD names the record that would verify the account, so a real player is released as soon as it arrives.

New Jersey’s Division of Gaming Enforcement said in 2021 that withdrawals are not required to be immediately available, that operators need a reasonable time to make sure money is not being given to fraudsters, and that the delay should be no longer than needed for an anti-fraud or anti-money-laundering check. Pennsylvania’s Industry Guidance 2025-01 names fraud, bonus abuse and account sharing among the problems its enhanced know-your-customer requirements are meant to prevent.

What the regulators have fined

• March 2026, Pennsylvania. The Gaming Control Board fined BetMGM, LLC $100,000 for failing to have sufficient procedures to prevent fraudulent behaviour and for insufficient know-your-customer protocols on its BetMGM and Borgata platforms: accounts were created with other people’s identifying information and funded with stolen or fraudulently obtained payment devices.
• May 2026, Pennsylvania. The Board fined Wind Creek Bethlehem, LLC $50,000 for failing to follow know-your-customer guidelines, which it said resulted in fraudulent withdrawals of more than $92,000 from iGaming accounts.
• Self-exclusion. Both regulators have also fined online operators for letting self-excluded players gamble, a reminder that the same identity controls carry both duties.

Casinos licensed by a state and with more than $1 million in gross annual gaming revenue are also casinos under the Bank Secrecy Act, with a written anti-money-laundering programme and suspicious activity reporting from $5,000 (31 CFR 1021.210 and 1021.320).

What a regulator-ready record looks like

• Append-only and dated. Every decision is added, never overwritten: the withdrawal, what was checked, what was found.
• Who decided, and why. The named reviewer, the rule applied, and the record that verified or would verify the account.
• Release tied to decision. Money leaves only after GO, and the record shows the order.
• Readable later. A regulator, an auditor or your own compliance officer can follow one withdrawal from request to release without asking anyone.

Questions people ask

How do online casinos stop payout fraud?

By putting the control at the withdrawal: reading the withdrawing account in context rather than alone, holding the releases the operator's rules mark for review, and having a named reviewer decide under written rules, with an append-only record of each decision.

Can an online casino delay a withdrawal for a fraud check?

New Jersey's Division of Gaming Enforcement said in its Director's Advisory Bulletin 2021-01 that withdrawals are not required to be immediately available and that operators need a reasonable time to make sure money is not given to fraudsters, with no delay longer than needed for an anti-fraud or anti-money-laundering check. Rules differ by state; this is not legal advice.

Why did the Pennsylvania Gaming Control Board fine BetMGM in 2026?

On 25 March 2026 the Board fined BetMGM, LLC $100,000 for failing to have sufficient procedures to prevent fraudulent behaviour and for insufficient know-your-customer protocols, after accounts were created with other people's identifying information and funded with stolen or fraudulently obtained payment devices.

Do online casinos have anti-money-laundering obligations?

A casino licensed by a state with more than $1 million in gross annual gaming revenue is a casino under the Bank Secrecy Act and must have a written anti-money-laundering program and file suspicious activity reports from $5,000 (31 CFR 1021.210 and 1021.320).

Sources

• Pennsylvania Gaming Control Board, “PA Gaming Control Board Fines BetMGM $100,000”, 25 March 2026.
• Pennsylvania Gaming Control Board, fines including Wind Creek Bethlehem, LLC, 20 May 2026.
• Pennsylvania Gaming Control Board, Industry Guidance 2025-01, enhanced KYC, 22 January 2025.
• New Jersey Division of Gaming Enforcement, Director’s Advisory Bulletin 2021-01, withdrawal requests, 13 January 2021.
• Pennsylvania Gaming Control Board, self-exclusion fine, 29 January 2025; New Jersey Division of Gaming Enforcement, Order 2890, October 2025.
• 31 CFR Part 1021, casinos and card clubs, and 31 CFR 1010.100(t), read 13 October 2026.

General information, not legal advice. BSJ Ventures publishes methods; it never publishes clients, cases or verdicts, and it claims no relationship with any agency, company or maker named here.